CVE-2023-52777

What it actually does

Missing RCU read-side critical section in ath11k gtk offload status event handling allows concurrent modification of protected pdev structures, resulting in use-after-free.

Why it matters to the business

Kernel instability or potential code execution in WiFi-enabled Linux systems; low public exploitability but high impact if triggered in production wireless environments.

How an attack unfolds

An attacker with local or adjacent network access triggers gtk offload status events while pdev lifecycle changes occur, racing the unprotected ath11k_mac_get_arvif_by_vdev_id lookup to dereference freed memory.

How to fix it

Upgrade the Linux kernel to the commit 0cf7577b6b3153b4b49deea9719fe43f96469c6d or later stable releases containing the RCU read-side annotation for gtk offload handling.

How to confirm the fix worked

Verify the presence of the RCU read-lock around ath11k_mac_get_arvif_by_vdev_id calls in the ath11k mac.c source or confirm the kernel git commit matches the fixed revision.

Typical attack path

1. Obtain local or WiFi-adjacent access to target system
2. Force gtk offload status event generation under RCU-protected pdev churn
3. Trigger use-after-free via concurrent vdev or pdev teardown
4. Leverage resulting kernel memory corruption for escalation or denial of service

How to detect it

Review kernel logs for ath11k-related oops or warnings mentioning RCU or use-after-free during gtk offload events; inspect wireless driver activity around pdev teardown.

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on all ath11k-equipped systems
• Monitor vendor kernel advisories for backported fixes in LTS branches
• Restrict untrusted local access and WiFi configuration changes until patched